tcp: add drop reason support to tcp_validate_incoming()

Creates four new drop reasons for the following cases:

1) packet being rejected by RFC 7323 PAWS check
2) packet being rejected by SEQUENCE check
3) Invalid RST packet
4) Invalid SYN packet

Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 0ef11df1bc67f26a454a809396bd93299ce787ad..a903da1fa0ed897ba65a3edf6d74d7e5dc575b2e 100644 (file)
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -381,6 +381,12 @@ enum skb_drop_reason {
                                         * the ofo queue, corresponding to
                                         * LINUX_MIB_TCPOFOMERGE
                                         */
+       SKB_DROP_REASON_TCP_RFC7323_PAWS, /* PAWS check, corresponding to
+                                          * LINUX_MIB_PAWSESTABREJECTED
+                                          */
+       SKB_DROP_REASON_TCP_INVALID_SEQUENCE, /* Not acceptable SEQ field */
+       SKB_DROP_REASON_TCP_RESET,      /* Invalid RST packet */
+       SKB_DROP_REASON_TCP_INVALID_SYN, /* Incoming packet has unexpected SYN flag */
        SKB_DROP_REASON_IP_OUTNOROUTES, /* route lookup failed */
        SKB_DROP_REASON_BPF_CGROUP_EGRESS,      /* dropped by
                                                 * BPF_PROG_TYPE_CGROUP_SKB

diff --git a/include/trace/events/skb.h b/include/trace/events/skb.h
index 2da72a9a576462bee9f3415141dfffd2eec8c258..820dacd14bad9ecb2b8ff6206cb33b392c0c442c 100644 (file)
--- a/include/trace/events/skb.h
+++ b/include/trace/events/skb.h
@@ -37,6 +37,11 @@
        EM(SKB_DROP_REASON_TCP_OLD_DATA, TCP_OLD_DATA)          \
        EM(SKB_DROP_REASON_TCP_OVERWINDOW, TCP_OVERWINDOW)      \
        EM(SKB_DROP_REASON_TCP_OFOMERGE, TCP_OFOMERGE)          \
+       EM(SKB_DROP_REASON_TCP_RFC7323_PAWS, TCP_RFC7323_PAWS)  \
+       EM(SKB_DROP_REASON_TCP_INVALID_SEQUENCE,                \
+          TCP_INVALID_SEQUENCE)                                \
+       EM(SKB_DROP_REASON_TCP_RESET, TCP_RESET)                \
+       EM(SKB_DROP_REASON_TCP_INVALID_SYN, TCP_INVALID_SYN)    \
        EM(SKB_DROP_REASON_IP_OUTNOROUTES, IP_OUTNOROUTES)      \
        EM(SKB_DROP_REASON_BPF_CGROUP_EGRESS,                   \
           BPF_CGROUP_EGRESS)                                   \

diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index b2d5fbef6ce3baa9426b3c9750002317a8915596..9a1cb3f48c3fb26beac4283001d38828ca15a4d9 100644 (file)
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -5667,6 +5667,7 @@ static bool tcp_validate_incoming(struct sock *sk, struct sk_buff *skb,
                                  const struct tcphdr *th, int syn_inerr)
 {
        struct tcp_sock *tp = tcp_sk(sk);
+       SKB_DR(reason);
 
        /* RFC1323: H1. Apply PAWS check first. */
        if (tcp_fast_parse_options(sock_net(sk), skb, th, tp) &&
@@ -5678,6 +5679,7 @@ static bool tcp_validate_incoming(struct sock *sk, struct sk_buff *skb,
                                                  LINUX_MIB_TCPACKSKIPPEDPAWS,
                                                  &tp->last_oow_ack_time))
                                tcp_send_dupack(sk, skb);
+                       SKB_DR_SET(reason, TCP_RFC7323_PAWS);
                        goto discard;
                }
                /* Reset is accepted even if it did not pass PAWS. */
@@ -5701,6 +5703,7 @@ static bool tcp_validate_incoming(struct sock *sk, struct sk_buff *skb,
                } else if (tcp_reset_check(sk, skb)) {
                        goto reset;
                }
+               SKB_DR_SET(reason, TCP_INVALID_SEQUENCE);
                goto discard;
        }
 
@@ -5743,6 +5746,7 @@ static bool tcp_validate_incoming(struct sock *sk, struct sk_buff *skb,
                    sk->sk_state == TCP_ESTABLISHED)
                        tcp_fastopen_active_disable(sk);
                tcp_send_challenge_ack(sk);
+               SKB_DR_SET(reason, TCP_RESET);
                goto discard;
        }
 
@@ -5757,6 +5761,7 @@ syn_challenge:
                        TCP_INC_STATS(sock_net(sk), TCP_MIB_INERRS);
                NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPSYNCHALLENGE);
                tcp_send_challenge_ack(sk);
+               SKB_DR_SET(reason, TCP_INVALID_SYN);
                goto discard;
        }
 
@@ -5765,7 +5770,7 @@ syn_challenge:
        return true;
 
 discard:
-       tcp_drop(sk, skb);
+       tcp_drop_reason(sk, skb, reason);
        return false;
 
 reset: